Re: QPJOBLOG security

[Chuck Lewis <clewis@xxxxxxxxxx>]

Jill,

Be REAL careful assuming that menu security with no command line will prevent
WRKSPLF and WRKSMBJOB, etc.. I "assume" that you have signed on with a user menu
and hit the Sys Req/Attn key to see what they get with that ? MANY 3rd party
software vendors use this and we found out the hard way that some clever users
were managing to MOVE THEIR JOBS AROUND, etc. !!!!

Chuck

Jill Gallagher wrote:

> John,
> >
> > Because of the crazy way that spool file security works, your
> > users will still be
> > able to delete their own spool files by issuing the WRKSPLF,
> > WRKJOB, WRKSBMJOB,
> > etc. commands.  Sure, you can secure the OUTQ, but the user
> > doesn't have to go
> > through the OUTQ to get to the spool file (It's a bit of an odd
> > relationship, but
> > the spool file doesn't actually live in the OUTQ, it lives in a
> > multimember file
> > named something like QSPL/Q04079N001).  Any tool that gives them
> > access to their
> > spool files without directly referencing the OUTQ (such as the mentioned
> > commands, Ops Nav, etc) will give the user the opportunity to
> > delete those spool
> > files. simply because they own those spool files.  It's on eof
> > those quirks of
> > AS/400 security.
> >
> > jte
> >
>
> That's good to know.  I hadn't realized that.  Our users work from menus and
> can't get to either their own spool files or a command line.  It was mainly
> for the operators so we could keep their joblogs in case of problems to
> figure out what happened.  I'll have to take a look at that and see if there
> is another way to secure those from them.
>
> Thanks!
>
> Jill
>
> +---
> | This is the Midrange System Mailing List!
> | To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> | To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> | To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
> | Questions should be directed to the list owner/operator: david@midrange.com
> +---

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---